Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface.
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects,…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large…
Opis źródłowy NVD · ENCVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
CVSS
8,7
EPSS
0,35 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the dot1x daemon of Juniper Networks Junos OS devices operating as Junos Fusion Aggregation Devices allows an adjacent attacker acting as the configured ICCP peer to cause a denial of service and potentially execute code as root via. The issue is…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Networks Junos OS allows an attacker able to influence a configured RADIUS server to cause authd to crash or execute code with root privileges via a malicious RADIUS response.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Juniper Networks on Junos OS and Junos OS Evolved allows an unauthenticated adjacent network attacker to execute code as root or cause a denial of service via an EAPOL frame sent to an 802.1X-authenticated interface.
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction regular expression applied during API error handling consumes excessive CPU on long request bodies. Unauthenticated remote attackers can concurrently send a small number of large…
Opis źródłowy NVD · EN
Obserwuj
CVSS 8,7 · EPSS 0,35 % · rekomendacja wg zapisanej polityki
8,7
0,35 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.